Homepage

gitlab-rails-ce-19.0

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the gitlab-rails-ce-19.0 package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free
VulnerabilityVulnerable Version
  • L
GHSA-c3rm-3hqr-4qwm

<19.0.9-r1
  • L
GHSA-7p8r-x3mc-p8w7

<19.0.9-r1
  • L
CVE-2026-76172

<19.0.9-r1
  • L
CVE-2026-75975

<19.0.9-r1
  • L
Race Condition

<19.0.9-r1
  • L
CVE-2026-84292

<19.0.9-r1
  • L
Incorrect Authorization

<19.0.9-r1
  • L
GHSA-qw65-cvwx-89v3

<19.0.9-r1
  • L
CVE-2026-16221

<19.0.9-r1
  • L
GHSA-jqff-g426-hqxp

<19.0.9-r1
  • L
CVE-2026-13676

<19.0.9-r1
  • L
CVE-2026-18446

<19.0.9-r1
  • L
GHSA-f65p-4m7j-42xc

<19.0.9-r1
  • L
GHSA-vp7f-562j-4qgr

<19.0.9-r1
  • L
GHSA-4c8g-83qw-93j6

<19.0.9-r1
  • L
GHSA-v2hh-gcrm-f6hx

<19.0.9-r1
  • L
CVE-2026-85706

<19.0.9-r0
  • L
GHSA-f47w-mrg9-g9p2

<19.0.9-r0
  • L
GHSA-3h96-34p3-xm76

<19.0.9-r0
  • H
Inefficient Regular Expression Complexity

<19.0.2-r0
  • M
Memory Leak

<19.0.2-r0
  • L
GHSA-5jhf-fpp7-v2pv

<19.0.2-r0
  • L
GHSA-rh9x-7xjc-vwx2

<19.0.2-r0
  • L
GHSA-6mxv-c89j-2494

<19.0.8-r3
  • L
Allocation of Resources Without Limits or Throttling

<19.0.8-r3
  • L
GHSA-395f-4hp3-45gv

<19.0.8-r2
  • L
CVE-2026-13311

<19.0.8-r2
  • L
GHSA-36jr-mh4h-2g58

<19.0.8-r1
  • L
Link Following

<19.0.6-r1
  • L
GHSA-qgq7-7hm3-q39j

<19.0.6-r1
  • L
Directory Traversal

<19.0.6-r1
  • L
GHSA-hc8v-wwc9-vgxm

<19.0.6-r1
  • L
XML Injection

<19.0.5-r21
  • L
GHSA-x6wf-f3px-wcqx

<19.0.5-r21
  • L
GHSA-j759-j44w-7fr8

<19.0.5-r21
  • L
GHSA-2v35-w6hq-6mfw

<19.0.5-r21
  • L
XML Injection

<19.0.5-r21
  • L
GHSA-f6ww-3ggp-fr8h

<19.0.5-r21
  • L
Uncontrolled Recursion

<19.0.5-r21
  • L
GHSA-wh4c-j3r5-mjhp

<19.0.5-r21
  • L
XML Injection

<19.0.5-r21
  • L
XML Injection

<19.0.5-r21
  • H
Loop with Unreachable Exit Condition ('Infinite Loop')

<19.0.5-r20
  • L
GHSA-2v37-7h3g-55p8

<19.0.5-r20
  • H
Loop with Unreachable Exit Condition ('Infinite Loop')

<19.0.5-r20
  • L
GHSA-28wg-ghj8-5hjv

<19.0.5-r20
  • C
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<19.0.5-r12
  • L
Uncontrolled Recursion

<19.0.5-r12
  • L
GHSA-rf6f-7fwh-wjgh

<19.0.5-r12
  • L
GHSA-25h7-pfq9-p65f

<19.0.5-r12
  • C
Improper Certificate Validation

<19.0.5-r1
  • L
GHSA-65ch-62r8-g69g

<19.0.5-r1
  • L
Loop with Unreachable Exit Condition ('Infinite Loop')

<19.0.5-r1
  • L
GHSA-q67f-28xg-22rw

<19.0.5-r1
  • H
Uncontrolled Recursion

<19.0.5-r1
  • L
GHSA-5gfm-wpxj-wjgq

<19.0.5-r1
  • L
Improper Input Validation

<19.0.5-r1
  • M
Integer Overflow or Wraparound

<19.0.5-r1
  • L
GHSA-5m6q-g25r-mvwx

<19.0.5-r1
  • L
GHSA-ppp5-5v6c-4jwp

<19.0.5-r1
  • L
GHSA-2328-f5f3-gj25

<19.0.5-r1
  • L
GHSA-554w-wpv2-vw27

<19.0.5-r1
  • L
CVE-2025-12816

<19.0.5-r1
  • L
Improper Verification of Cryptographic Signature

<19.0.5-r1
  • L
Insecure Default Initialization of Resource

<19.0.5-r0
  • L
GHSA-xr9x-r78c-5hrm

<19.0.5-r0
  • L
GHSA-gvwx-54wh-qm9j

<19.0.4-r10
  • L
GHSA-w8wr-v893-vjvp

<19.0.4-r10
  • L
GHSA-8x88-c5mf-7j5w

<19.0.4-r10
  • L
Uncaught Exception

<19.0.4-r10
  • L
Incorrect Type Conversion or Cast

<19.0.4-r10
  • L
Allocation of Resources Without Limits or Throttling

<19.0.4-r10
  • L
GHSA-23hp-3jrh-7fpw

<19.0.4-r10
  • L
Loop with Unreachable Exit Condition ('Infinite Loop')

<19.0.4-r10
  • L
GHSA-mp7j-qc5w-4988

<19.0.4-r9
  • L
GHSA-xv26-6w52-cph6

<19.0.4-r9
  • L
Allocation of Resources Without Limits or Throttling

<19.0.4-r9
  • H
Improper Handling of Length Parameter Inconsistency

<19.0.4-r9
  • L
GHSA-jpcc-p29g-p8mq

<19.0.4-r6
  • L
GHSA-xhf5-7wjv-pqxp

<19.0.4-r6
  • L
Improper Input Validation

<19.0.4-r6
  • L
CVE-2026-47262

<19.0.4-r6
  • H
Inefficient Regular Expression Complexity

<19.0.4-r5
  • L
GHSA-22p9-wv53-3rq4

<19.0.4-r5
  • L
GHSA-w7jw-789q-3m8p

<19.0.4-r4
  • L
CVE-2026-9277

<19.0.4-r4
  • L
GHSA-w5pp-99ch-qj29

<19.0.4-r3
  • L
GHSA-crhj-59gh-8x96

<19.0.4-r3
  • L
Directory Traversal

<19.0.4-r3
  • C
Improper Encoding or Escaping of Output

<19.0.4-r3
  • L
GHSA-m7cr-m3pv-hgrp

<19.0.4-r3
  • L
GHSA-h7cp-r72f-jxh6

<19.0.4-r2
  • L
CVE-2025-6547

<19.0.4-r2
  • L
CVE-2025-6545

<19.0.4-r2
  • L
GHSA-v62p-rq8g-8h59

<19.0.4-r2
  • L
GHSA-cpq7-6gpm-g9rc

<19.0.3-r5
  • C
CVE-2025-9287

<19.0.3-r5
  • L
GHSA-95m3-7q98-8xr5

<19.0.3-r4
  • C
CVE-2025-9288

<19.0.3-r4
  • C
Directory Traversal

<19.0.3-r3
  • L
GHSA-rgh6-rfwx-v388

<19.0.3-r3
  • L
GHSA-84xv-jfrm-h4gm

<19.0.3-r3
  • L
Symlink Following

<19.0.3-r3
  • L
CVE-2026-50195

<19.0.3-r3
  • L
GHSA-33vj-92qq-66hc

<19.0.3-r3
  • L
Improper Input Validation

<19.0.3-r3
  • L
GHSA-cvxm-645q-p574

<19.0.3-r3
  • L
GHSA-5xrq-8626-4rwp

<19.0.3-r3
  • M
Directory Traversal

<19.0.3-r3
  • H
Arbitrary Code Injection

<19.0.3-r1
  • L
GHSA-67mh-4wv8-2f99

<19.0.3-r1
  • H
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<19.0.3-r1
  • L
GHSA-h67p-54hq-rp68

<19.0.3-r1
  • L
GHSA-8cj5-5rvv-wf4v

<19.0.3-r1
  • L
GHSA-9ppj-qmqm-q256

<19.0.4-r10
  • L
Inefficient Regular Expression Complexity

<19.0.3-r1
  • L
Resource Exhaustion

<19.0.3-r1
  • C
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<19.0.3-r1
  • L
GHSA-qffp-2rhf-9h96

<19.0.4-r10
  • L
GHSA-4x5r-pxfx-6jf8

<19.0.3-r1
  • L
GHSA-5j98-mcp5-4vw2

<19.0.3-r1
  • L
GHSA-952p-6rrq-rcjv

<19.0.3-r1
  • L
GHSA-v39h-62p7-jpjc

<19.0.9-r1
  • H
CVE-2026-2391

<19.0.3-r1
  • L
GHSA-7rx3-28cr-v5wh

<19.0.3-r1
  • L
GHSA-3w6x-2g7m-8v23

<19.0.6-r3
  • M
CVE-2025-13465

<19.0.3-r1
  • H
Information Exposure

<19.0.3-r1
  • L
GHSA-q7cg-457f-vx79

<19.0.3-r1
  • L
Permissive Whitelist

<19.0.3-r1
  • L
GHSA-m7pr-hjqh-92cm

<19.0.3-r1
  • L
GHSA-898c-q2cr-xwhg

<19.0.3-r1
  • H
Resource Exhaustion

<19.0.3-r1
  • L
GHSA-pf86-5x62-jrwf

<19.0.3-r1
  • L
HTTP Response Splitting

<19.0.3-r1
  • L
GHSA-qj8w-gfj5-8c6v

<19.0.3-r1
  • L
GHSA-hfxv-24rg-xrqf

<19.0.3-r1
  • L
Algorithmic Complexity

<19.0.3-r1
  • L
Cross-site Scripting (XSS)

<19.0.3-r1
  • L
CVE-2024-4068

<19.0.3-r1
  • L
Uncontrolled Recursion

<19.0.3-r1
  • L
CVE-2025-7783

<19.0.3-r1
  • L
GHSA-48c2-rrv3-qjmp

<19.0.3-r1
  • L
Arbitrary Code Injection

<19.0.3-r1
  • C
Improperly Controlled Modification of Dynamically-Determined Object Attributes

<19.0.6-r3
  • L
Improper Check for Unusual or Exceptional Conditions

<19.0.3-r1
  • L
Resource Exhaustion

<19.0.3-r1
  • L
Allocation of Resources Without Limits or Throttling

<19.0.3-r1
  • L
GHSA-xx6v-rp6x-q39c

<19.0.3-r1
  • L
GHSA-grv7-fg5c-xmjg

<19.0.3-r1
  • L
Information Exposure

<19.0.3-r1
  • L
GHSA-p92q-9vqr-4j8v

<19.0.3-r1
  • L
GHSA-3ppc-4f35-3m26

<19.0.3-r1
  • L
GHSA-pmwg-cvhr-8vh7

<19.0.3-r1
  • L
Algorithmic Complexity

<19.0.3-r1
  • L
Directory Traversal

<19.0.3-r1
  • L
CVE-2025-15284

<19.0.3-r1
  • L
GHSA-w5hq-g745-h8pq

<19.0.3-r1
  • L
GHSA-6chq-wfr3-2hj9

<19.0.3-r1
  • H
Cross-site Scripting (XSS)

<19.0.3-r1
  • L
GHSA-f886-m6hf-6m8v

<19.0.3-r1
  • L
GHSA-9cx6-37pm-9jff

<19.0.3-r1
  • H
Out-of-bounds Write

<19.0.3-r1
  • L
GHSA-pjwm-pj3p-43mv

<19.0.3-r1
  • C
Unintended Proxy or Intermediary ('Confused Deputy')

<19.0.3-r1
  • M
CVE-2024-4067

<19.0.3-r1
  • L
GHSA-6rw7-vpxm-498p

<19.0.3-r1
  • L
Unintended Proxy or Intermediary ('Confused Deputy')

<19.0.6-r3
  • L
GHSA-r5fr-rjxr-66jc

<19.0.3-r1
  • L
GHSA-j5f8-grm9-p9fc

<19.0.3-r1
  • H
Arbitrary Code Injection

<19.0.3-r1
  • M
Improper Authentication

<19.0.3-r1
  • L
GHSA-96hv-2xvq-fx4p

<19.0.3-r1
  • L
CVE-2026-4867

<19.0.3-r1
  • L
GHSA-vmf3-w455-68vh

<19.0.4-r10
  • L
Server-Side Request Forgery (SSRF)

<19.0.3-r1
  • L
Directory Traversal

<19.0.3-r1
  • M
Improper Verification of Cryptographic Signature

<19.0.3-r1
  • H
Server-Side Request Forgery (SSRF)

<19.0.3-r1
  • M
Directory Traversal

<19.0.4-r10
  • L
Arbitrary Code Injection

<19.0.3-r1
  • C
Permissive Whitelist

<19.0.3-r1
  • C
CVE-2026-4800

<19.0.3-r1
  • L
Allocation of Resources Without Limits or Throttling

<19.0.6-r3
  • L
CVE-2026-6322

<19.0.9-r1
  • L
GHSA-r4q5-vmmm-2653

<19.0.3-r1
  • L
GHSA-5c9x-8gcm-mpgx

<19.0.3-r1
  • L
Server-Side Request Forgery (SSRF)

<19.0.3-r1
  • L
Directory Traversal

<19.0.4-r10
  • L
CRLF Injection

<19.0.6-r3
  • L
GHSA-q8mj-m7cp-5q26

<19.0.3-r1
  • L
OS Command Injection

<19.0.3-r1
  • L
Arbitrary Code Injection

<19.0.3-r1
  • L
GHSA-v6h2-p8h4-qcjw

<19.0.3-r1
  • L
GHSA-5c6j-r48x-rmvq

<19.0.3-r1
  • M
Arbitrary Code Injection

<19.0.3-r1
  • L
GHSA-62hf-57xw-28j9

<19.0.3-r1
  • L
GHSA-445q-vr5w-6q77

<19.0.6-r3
  • L
GHSA-q3j6-qgpj-74h6

<19.0.9-r1
  • L
GHSA-fvcv-3m26-pcqx

<19.0.3-r1
  • L
GHSA-qx2v-qp2m-jg93

<19.0.3-r1
  • L
GHSA-2g4f-4pwh-qvx6

<19.0.3-r1
  • L
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<19.0.3-r1
  • L
Uncaught Exception

<19.0.3-r1
  • L
GHSA-34x7-hfp2-rc4v

<19.0.4-r10
  • L
GHSA-xjpj-3mr7-gcpf

<19.0.3-r1
  • M
Directory Traversal

<19.0.4-r10
  • L
Interpretation Conflict

<19.0.4-r10
  • L
GHSA-38r7-794h-5758

<19.0.3-r1
  • H
Uncontrolled Recursion

<19.0.3-r1
  • C
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<19.0.6-r3
  • L
GHSA-777c-7fjr-54vf

<19.0.6-r3
  • L
GHSA-968p-4wvh-cqc8

<19.0.3-r1
  • L
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<19.0.3-r1
  • L
GHSA-r6q2-hw4h-h46w

<19.0.4-r10
  • M
Improper Handling of Unicode Encoding

<19.0.4-r10
  • L
GHSA-3mfm-83xf-c92r

<19.0.3-r1
  • L
Resource Exhaustion

<19.0.3-r1
  • L
GHSA-hmw2-7cc7-3qxx

<19.0.3-r1
  • L
Improper Encoding or Escaping of Output

<19.0.3-r1
  • L
GHSA-f23m-r3pf-42rh

<19.0.3-r1
  • L
GHSA-83g3-92jg-28cx

<19.0.4-r10
  • L
GHSA-8qq5-rm4j-mr97

<19.0.4-r10
  • H
Use of Uninitialized Resource

<19.0.3-r1
  • L
GHSA-58qx-3vcg-4xpx

<19.0.3-r1
  • L
GHSA-mh29-5h37-fv8m

<19.0.3-r1
  • L
GHSA-q8qp-cvcw-x6jj

<19.0.6-r3
  • L
GHSA-3p68-rc4w-qgx5

<19.0.3-r1
  • L
Server-Side Request Forgery (SSRF)

<19.0.3-r1
  • L
GHSA-xhjh-pmcv-23jw

<19.0.3-r1
  • L
GHSA-xxjr-mmjv-4gpg

<19.0.3-r1
  • L
GHSA-442j-39wm-28r2

<19.0.3-r1
  • L
GHSA-vf2m-468p-8v99

<19.0.3-r1
  • L
GHSA-3g43-6gmg-66jw

<19.0.3-r1
  • L
Inefficient Regular Expression Complexity

<19.0.3-r1
  • L
GHSA-737v-mqg7-c878

<19.0.3-r1
  • L
GHSA-xhpv-hc6g-r9c6

<19.0.3-r1
  • M
Cross-site Scripting (XSS)

<19.0.3-r1
  • L
Allocation of Resources Without Limits or Throttling

<19.0.3-r1
  • L
GHSA-76c9-3jph-rj3q

<19.0.3-r1
  • L
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<19.0.3-r1
  • L
GHSA-37ch-88jc-xwx2

<19.0.3-r1
  • L
GHSA-vj76-c3g6-qr5v

<19.0.3-r1
  • L
GHSA-7fh5-64p2-3v2j

<19.0.3-r1
  • L
Improper Check for Unusual or Exceptional Conditions

<19.0.3-r1
  • H
Inefficient Regular Expression Complexity

<19.0.3-r1
  • L
Inefficient Regular Expression Complexity

<19.0.3-r1
  • L
GHSA-7r86-cg39-jmmj

<19.0.3-r1
  • M
CVE-2026-2950

<19.0.3-r1
  • M
HTTP Response Splitting

<19.0.3-r1
  • L
GHSA-w9j2-pvgh-6h63

<19.0.3-r1
  • L
Directory Traversal

<19.0.3-r1
  • L
GHSA-3v7f-55p6-f55p

<19.0.3-r1
  • L
GHSA-c2c7-rcm5-vvqj

<19.0.3-r1
  • L
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<19.0.3-r1
  • L
GHSA-8fgc-7cc6-rx7x

<19.0.3-r1
  • L
CVE-2026-12143

<19.0.3-r1
  • H
Directory Traversal

<19.0.4-r10
  • M
Directory Traversal

<19.0.4-r10
  • L
GHSA-2qvq-rjwj-gvw9

<19.0.3-r1
  • L
GHSA-7mvr-c777-76hp

<19.0.3-r1
  • L
GHSA-35jp-ww65-95wh

<19.0.6-r3
  • L
Inefficient Regular Expression Complexity

<19.0.3-r1
  • L
GHSA-23c5-xmqv-rm74

<19.0.3-r1
  • L
GHSA-4hjh-wcwx-xvwj

<19.0.3-r1
  • L
CVE-2025-7339

<19.0.3-r1
  • L
CVE-2026-8723

<19.0.3-r1
  • L
CVE-2026-6321

<19.0.9-r1
  • L
GHSA-wf6x-7x77-mvgw

<19.0.3-r1
  • L
GHSA-fjxv-7rqg-78g4

<19.0.3-r1
  • L
GHSA-fv7c-fp4j-7gwp

<19.0.3-r1
  • L
Allocation of Resources Without Limits or Throttling

<19.0.3-r1
  • H
Resource Exhaustion

<19.0.3-r1
  • L
GHSA-43fc-jf86-j433

<19.0.3-r1
  • L
GHSA-w7fw-mjwx-w883

<19.0.3-r1
  • L
GHSA-2w6w-674q-4c4q

<19.0.3-r1
  • L
GHSA-vgwf-h737-ff37

<19.0.1-r1
  • L
GHSA-q4h4-gmj2-qvw2

<19.0.1-r1
  • L
GHSA-5cgq-3rg8-m6cv

<19.0.1-r1
  • L
GHSA-f5wc-c3c7-36mc

<19.0.1-r1
  • L
GHSA-78mq-xcr3-xm33

<19.0.1-r1
  • L
GHSA-rm3j-f69w-wqmq

<19.0.1-r1
  • L
GHSA-w879-237q-wc7r

<19.0.1-r1
  • L
GHSA-89gr-r52h-f8rx

<19.0.1-r1
  • L
GHSA-qpw4-5x99-6vjp

<19.0.1-r1
  • L
GHSA-h27x-rffw-24p4

<19.0.2-r2
  • L
Inefficient Regular Expression Complexity

<19.0.2-r2
  • L
GHSA-2vqw-3mp8-cgmx

<19.0.2-r1
  • L
Resource Exhaustion

<19.0.2-r1
  • L
GHSA-qpgp-93vx-g8v8

<19.0.2-r1
  • L
Authentication Bypass

<19.0.2-r1
  • L
GHSA-8p34-64r3-mwg8

<19.0.2-r0
  • L
GHSA-c4fp-cxrr-mj66

<19.0.2-r0
  • L
GHSA-v2fc-qm4h-8hqv

<19.0.2-r0
  • L
Improper Authentication

<19.0.2-r0
  • L
Arbitrary Command Injection

<19.0.2-r0
  • L
GHSA-46q3-7gv7-qmgg

<19.0.2-r0
  • L
Arbitrary Command Injection

<19.0.2-r0
  • L
GHSA-c4rq-3m3g-8wgx

<19.0.2-r0
  • L
GHSA-c32j-vqhx-rx3x

<19.0.2-r0
  • L
Improper Neutralization

<19.0.2-r0
  • L
GHSA-fqw6-gf59-qr4w

<19.0.1-r4
  • L
Improper Privilege Management

<19.0.1-r4
  • L
CVE-2026-27145

<19.0.1-r2
  • L
GHSA-h3gm-q7m7-mp28

<19.0.1-r2
  • L
CVE-2026-42507

<19.0.1-r2
  • L
GHSA-4279-q6mj-392r

<19.0.1-r2
  • L
Improper Enforcement of Message Integrity During Transmission in a Communication Channel

<19.0.1-r1
  • L
Missing Authorization

<19.0.1-r1
  • L
Out-of-Bounds

<19.0.1-r1
  • L
Integer Overflow or Wraparound

<19.0.1-r1
  • L
Incorrect Type Conversion or Cast

<19.0.1-r1
  • L
Improper Verification of Cryptographic Signature

<19.0.1-r1
  • L
Improper Certificate Validation

<19.0.1-r1
  • L
Improper Certificate Validation

<19.0.1-r1
  • L
Deserialization of Untrusted Data

<19.0.1-r1
  • L
Allocation of Resources Without Limits or Throttling

<19.0.1-r0
  • L
GHSA-wgq9-qp63-g8j3

<19.0.1-r0
  • L
Incorrect Authorization

<19.0.1-r0
  • L
Use of Incorrectly-Resolved Name or Reference

<19.0.1-r0
  • L
GHSA-5p55-qcqv-882w

<19.0.1-r0
  • L
GHSA-r38r-hvg8-xqhf

<19.0.1-r0